Max Researcher at Advanced Research Institute wishes to combine data from an Electronic Health Record (EHR) at a mental health institution, claims data from the state Medicaid Management Information System (MMIS), survey data, and patient laboratory and medical device data into one data set for a SAMHSA funded evaluation study.
The information in the separate data sets was originally gathered for Treatment Payment and healthcare Operations (TPO) purposes.
The data will be linked on a probabilistic basis by name, data of birth (DOB), and address (i.e., using personally identifiable health information). The provider is also identified in claims data set.
The mental health institution and state Medicaid are both HIPAA covered entities. The mental health institution is a not-for-profit, ambulatory mental health program, but it is not a Part 2 covered facility.
- Max submits a protocol to the IRB and receives approval to conduct this study.
- Max Researcher develops data use agreements (DUAs) with the mental health institution and the state MMIS for handling of identifiable data for research purposes under the terms of consent. The DUAs all meet HIPAA requirements and lay out the terms of securing the data and the terms of consent documents as set by co-signatories. The DUA also includes consent to enroll participants from the mental health institution and providers at the institution.
- Max obtains consent and HIPAA authorization directly from the patients at the mental health institution to collect their electronic health record data, survey data, data from medical devices, laboratory data, and Medicaid files for research purposes. Consent is reconfirmed at six-month intervals.
- Medicaid may request copies of the consent forms and HIPAA authorization on file with the researcher at any time.
Max Researcher recruits patients into the study by asking the receptionist at the mental health institution to inform prospective participants about the study and placing recruitment flyers in the hospital. Patients who are interested can provide their information to the receptionist. Max Researcher calls interested patients to discuss the study and ask them if they would like to participate. The research team does not have any preexisting relationships with the patients. The patients do not receive an incentive for participation.
The patients at the mental health institution are adults residing in the community as outpatients in the ambulatory facility. They are able to give consent themselves since nobody enrolled in the study has been legally declared incompetent or have guardians/health care proxies that must give consent. Additional safeguards are in place such as cognitive testing of the consent and requirements for participant to repeat back to consenter what they agreed to in the study.
Max Researcher physically travels to the mental health institution to enroll interested patients. During the visit, Max obtains consent from the patients to collect the health records, claims data, survey data (i.e., patient interviews), data from medical devices (e.g., vital signs), and laboratory data (e.g., blood samples).
- The survey data is not preexisting; it is generated via patient responses to survey questions related to the study.
- The research team collects the data from the medical devices (e.g., weight, BP, height) manually, reading the devices and recording the data on paper.
- The laboratory data (e.g., cholesterol profile) is also not pre-existing; it is collected for the purposes of the study. For laboratory data, the participant’s samples are sent to an affiliated lab and the results are reported to researcher via the mental health institution’s EHR. The research team does not retain the physical samples.
- The Medicaid claims data that is collected for the study on each patient includes information on all services the patient has received during the study period, including medical, mental health, pharmacy, labs, inpatient, outpatient, etc. The data set is considered a complete record, but excludes psychotherapy notes. The scope of information collected for the study is disclosed to the patient in the IRB-approved consent form. Some of the data is subject to state mental health privacy laws and regulations.
Max will renew patient consent and HIPAA authorization for disclosure every six months. Opportunities for renewed consent ensure the patient has given reliable consent and understand what they are consenting to in the study. Obtaining and maintaining consent is the primary barrier to collecting and combining the data (please refer to the Patient Choice initiative). The research team uses the same initial consent form provided at enrollment to reconsent the patient. If the patient refuses to reconsent, no additional study data will be collected from the patient. The patient will have the option to leave their existing data in the study, or they may request that it is removed from the study’s data set. If the patient chooses to reconsent at the six month interval, the research team will administer the survey and collect medical device and lab data at that time, and combine these data with the patient’s EHR data.
To collect EHR and claims data, Max generates a list of patients that have consented to participate in the study. The terms of the DUA, consent, and HIPAA authorization allow Max Researcher to collect pre-specified data fields for this specific list of patients. Max Researcher e-mails the list to the EHR manager at the mental health institution and to the contact person at the State Medicaid Office. The list is not de-identified; however, it is encrypted for security and privacy purposes.
The EHR manager at the mental health institution uses the patient list provided by Max Researcher to pull the required data for each patient. The EHR manager encrypts the data and uses a secure File Transfer Protocol (FTP) to transmit the data (with PHI) to Max Researcher. Max’s research institution and the mental health institution have both conducted a security analysis review and confirmed that the transmission of the information meets their security policies and procedures. Max Researcher and her team follow the data security procedures and apply the administrative, technical, and physical safeguards outlined in the DUAs. The data set includes service utilization (procedure codes) and cost (charge) information. The mental health institution runs the query quarterly for two years following patient enrollment.
Max Researcher sends a data request and patient list to the representative at state Medicaid for all health claims information for patients enrolled in the study from the mental health institution. Max uses the patients’ Medicaid identifiers to indicate which patients are included in the study, having obtained that information from the mental health institution. Max Researcher requests health care claims every six months, which are transmitted through a secure FTP, as specified in the DUA
All data sets (EHR, state Medicaid claims, and patient survey data, data from medical devices, and laboratory data) include protected health information (PHI). Max Researcher combines all data sets by linking them with a unique identifier generated specifically for (and unique to) the study. Max Researcher’s research facility holds the data locally.
The combined data set helps Max evaluate the impact of integrating medical care into a mental health program serving seriously mentally ill adults. These are longitudinal data sets, with patients re-interviewed and vital signs and laboratory data collected at six-month intervals over a two-year period following recruitment into the study. The study two year period will mark the active data collection phase of the study. After that time, the researcher will analyze the collected data.
Max Researcher is the only data recipient to whom the data can be disclosed, and two years after the end of the active collection phase, Max must destroy the data, as specified in the DUA and consent documents. Max may not reuse the data or connect them with a different study. The participants do not have access to data collected for this study, but will receive the published results of the study.
| |
Description | The researcher combines behavioral health data and clinical data for his study. |
Primary actor/participant | Researcher |
Support actor/participant | Mental health institution EHR, MMIS, medical device data. |
Preconditions | - Patient consent for data disclosure to researcher from all systems in question.
- HIPAA authorization
- Psychotherapy notes cannot be disclosed by a HIPAA covered entity without the individual’s authorization. Consent required for access to Medicaid data. State mental health privacy requirements govern consent for mental health information from the mental health institution. Very specific and limited part of the mental health notes are considered psychotherapy notes.
- Researcher has IRB approval to collect consented biometric and survey data and request their behavioral health EHR data from the institution and Medicaid claims information.
- DUA with mental health institution authorizing the Researcher’s organization and its approved representatives to request and receive a minimum data set from their EHR and use the data set for a research study.
- Direct patient consent to collect survey and medical device data as well as Medicaid data.
- DUA with Medicaid to collect data from patients that have consented.
- Unique identifiers are generated by the researcher to link the data sets and protect the patients’ identity.
|
Post conditions | - Information was collected from three data sets and combined using a unique identifier (survey data, vitals, claims, and EHR).
- Researcher has a combined data set available to analyze for a specific research study.
|
Alternatives | - Patients do not renew their consent.
- The behavioral health data is pulled from individual PCP EHR systems.
- The behavioral health data is obtained from substance abuse treatment programs covered by Part 2 as it receives federal funding.
- The behavioral health data is obtained from a health information exchange organization.
|
Considerations | Mentally ill persons are considered special populations and IRBs are required to assure that sufficient safeguards are in place to protect the rights a welfare of these participants in research. |
Data Elements Considered | Clinical data from the mental health institution’s EHR, claims data from Medicaid, and survey/medical device data from participants |
Purpose of the Data Collection | - Clinical care, administrative/claims/billing purposes, research
- Some data is secondary data from EHR: administrative and services data.
- Some data is primary such as medical device data and survey data.
|
Purpose of Data Use | Analysis under a specific IRB approved research protocol |
Terms of Transfer to the Data Holders | Direct consent from participants to researcher for survey/medical device data and Medicaid claims data, DUA between mental health institution for EHR data and Max’s research institution, DUA between Medicaid and Max’s research institution, HIPAA authorization |
Terms of Transfer to Researchers | - IRB approval
- DUA for mental health institution’s EHR
- DUA for Medicaid MMIS data, but not BAA
|
Frequency | Data transfer quarterly |
